cmux NEXT Cloud: Release copies your Claude login to your own machine after a one-time consent, behind a remote off switch (step B)

Merged
TE
12h ago
+807-34

Step B of shipping the Mac-to-machine Claude login copy in Release (step A: #33061). Leo (2026-11-02), approving it on three conditions:

  1. "Consent first. It's on only after a clear one-time prompt: 'use my Claude login on my own Cloud machines'."
  2. "Your token only: your own token, to your own machine. Never stored by us, never on team machines, never shared."
  3. "A remote off switch, so if Anthropic objects we turn it off for everyone within minutes and fall back to the one-click sign-in."

What

  • Re-pins CCmuxAppFFI to cmux-app-ffi-a86fae37df02 (#33061's rules: ask-consent, remote-switch-off, consent-declined, owner-only in Release).
  • The one-time consent (CloudPresenter.confirmLoginCopy): "Use my Claude login on my own Cloud machines?" with Use My Login / Don't Use. It shows only where a copy would happen (signed in, the platform says the caller owns the machine, an owner guest, no working login there). The answer is the person's, kept in cmux.json as cloud.useMyClaudeLoginOnMyCloudMachines. Agents are refused (privacy). Settings > Machines > Cloud Workspaces turns it off or on again. A yes is the confirm, so no second prompt follows.
  • The remote switch (CloudHarnessLoginCopySwitch, CmuxNextCloud): GET /v1/cloud/harness-login-copy on the owner API (cmux-platform#587, forwarded by #33063), read fresh before every Release copy, with a 5 s deadline and a TTL capped at 5 minutes. Failed, unread or stale counts as off. Off skips the copy (remote-switch-off in the start record), and the chat's card offers the machine's own one-click "Sign in to Claude" (acpmux agent_login).
  • The turn card's recovery in Release: Claude only, the switch read fresh, then the consent. An automatic recovery never asks, and copies only with consent already given. The creator's team-guest allowance (allowsCreatorTeamGuestHere) stays DEV and NIGHTLY only.
  • DEV and NIGHTLY behave as before.

Risk: trust-sensitive (it moves a subscription token). The token still goes only Mac to machine disk over the existing machine file route or direct provider session. Audited: nothing on the classic /api/vm route, cmux-tui cloud machine-io or cmux-platform MachineGuest logs or stores it (cmux-platform#587 adds tests).

Design: leo-workspace design/cloud.md, "Subscription logins", rule 4.

Test

  • Fleet app compile check (recipe 2).
  • CloudStartChatLoginTests (Release gate, consent and switch through the FFI) and CloudHarnessLoginCopySwitchTests (decode, TTL cap, stale is off).

Agent session: agent session

šŸ¤– Generated with Claude Code

Autofix with [code]smith
Open in [code]smith Ā· Need help on this PR? Tag @codesmith-bot with what you need.

Summary by cubic

Enables Release builds to copy the user's own Claude login from their Mac to Cloud machines they own, after a one-time consent, while a remote off switch is on. Previously this was DEV and NIGHTLY only.

  • A "Use my Claude login on my own Cloud machines?" prompt asks once; only the person's own cmux.json can say yes ā€” any managed layer (MDM, team policy, defaults) holding the key is no, whatever its value. Settings > Machines can turn it off or on again.
  • A remote switch (GET /v1/cloud/harness-login-copy) is read fresh before every copy and rechecked right before the login is written; unread, failed, or stale counts as off, and the machine's chat then offers one-click "Sign in to Claude".
  • Copies go only to owner guests of machines the caller owns; team guests never receive it in Release, and the new-workspace setup gates on the switch too.
  • DEV and NIGHTLY builds behave as before.